Martin K. Petersen

A use-after-free issue has been resolved in the Linux kernel, specifically in the scsi: qla2xxx module. This issue occurs when the `dpc thread` is terminated using the `UNLOADING` flag and `kthread stop` simultaneously, causing a system crash with a stack trace warning of use-after-free. The `UNLOADING` flag is removed to terminate `dpc thread`, and `kthread stop` is used as the main signal to exit `dpc thread`. The issue is observed on HP ProLiant DL380p Gen8 systems with BIOS P70 08/20/2012.

The vulnerability is related to the `bnx2fc` driver in the Linux kernel. The `bnx2fc destroy()` function removes the interface before calling `destroy work`, resulting in multiple warnings from `sysfs remove group()` as the controller rport device attributes are removed too early. This issue can be reproduced by following specific steps, including enabling `fcoe` and executing `fipvlan` and `fcoeadm` commands. The problem is caused by the removal of the `fcoe port`'s `destroy work` queue, which is not needed.

The issue is related to a NULL pointer dereference in the `qedf update link speed()` function when `shost data` is not initialized. This occurs when the `qedf link update()` API is called from QED. The problem results in a NULL pointer dereference when trying to update `supported speeds`. To fix this, a NULL pointer check should be added before dereferencing `shost data`.

An issue was discovered in the MPT3COMMAND case in ctl ioctl main in drivers/scsi/mpt3sas/mpt3sas ctl.c. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of `ioc number` between two kernel reads of that value, aka a "double fetch" vulnerability. A third party reports that this is unexploitable because the doubly fetched value is not used.